shadowsocks

This is a port of shadowsocks.

shadowsocks is a fast tunnel proxy that helps you bypass firewalls.

Library	Description
shadowsocks	shadowsocks core protocol
shadowsocks-service	Services for serving shadowsocks
shadowsocks-rust	Binaries running common shadowsocks services

Related Projects:

• spyophobia/shadowsocks-gtk-rs A GUI on Linux for sslocal using GTK, discussion
• honwen/openwrt-shadowsocks-rust OpenWRT solution for sslocal, discussion
• cg31/shadowsocks-windows-gui-rust Windows GUI client, discussion

Build & Install

Optional Features

• hickory-dns - Uses hickory-resolver as DNS resolver instead of tokio's builtin.

• local-http - Allow using HTTP protocol for sslocal

  • local-http-native-tls - Support HTTPS with native-tls

  • local-http-rustls - Support HTTPS with rustls

• local-tunnel - Allow using tunnel protocol for sslocal

• local-socks4 - Allow using SOCKS4/4a protocol for sslocal

• local-redir - Allow using redir (transparent proxy) protocol for sslocal

• local-dns - Allow using dns protocol for sslocal, serves as a DNS server proxying queries to local or remote DNS servers by ACL rules

• local-fake-dns - FakeDNS, allocating an IP address for each individual Query from a specific IP pool

• local-tun - TUN interface support for sslocal

• local-online-config - SIP008 Online Configuration Delivery

• stream-cipher - Enable deprecated stream ciphers. WARN: stream ciphers are UNSAFE!

• aead-cipher-extra - Enable non-standard AEAD ciphers

• aead-cipher-2022 - Enable AEAD-2022 ciphers (SIP022)

• aead-cipher-2022-extra - Enable AEAD-2022 extra ciphers (non-standard ciphers)

Memory Allocators

This project uses system (libc) memory allocator (Rust's default). But it also allows you to use other famous allocators by features:

• jemalloc - Uses jemalloc as global memory allocator
• mimalloc - Uses mi-malloc as global memory allocator
• tcmalloc - Uses TCMalloc as global memory allocator. It tries to link system-wide tcmalloc by default, use vendored from source with tcmalloc-vendored.
• snmalloc - Uses snmalloc as global memory allocator
• rpmalloc - Uses rpmalloc as global memory allocator

crates.io

Install from crates.io:

# Install from crates.io
cargo install shadowsocks-rust

then you can find sslocal and ssserver in $CARGO_HOME/bin.

Install using Homebrew

For macOS and Linux, you can install it using Homebrew:

brew install shadowsocks-rust

Install using snap

# Install from snapstore
snap install shadowsocks-rust

# List services
snap services shadowsocks-rust

# Enable and start shadowsocks-rust.sslocal-daemon snap service
snap start --enable shadowsocks-rust.sslocal-daemon

# Show generated systemd service status
systemctl status snap.shadowsocks-rust.sslocal-daemon.service

# Override generated systemd service (configure startup options)
systemctl edit snap.shadowsocks-rust.sslocal-daemon.service

## NOTE: you can pass args to sslocal:
##  [Service]
##  ExecStart=
##  ExecStart=/usr/bin/snap run shadowsocks-rust.sslocal-daemon -b "127.0.0.1:1080" --server-url "ss://...."

# Restart generated systemd service to apply changes
systemctl restart snap.shadowsocks-rust.sslocal-daemon.service

# ... and show service status
systemctl status snap.shadowsocks-rust.sslocal-daemon.service

Default configuration file path probably is /var/snap/shadowsocks-rust/common/etc/shadowsocks-rust/config.json.

Download release

Download static-linked build here.

• Most of them are built with cross. Build environment details could be found in its README, such as glibc's version.
• x86_64-apple-darwin, aarch64-apple-darwin are built in github's macos-latest image. Information could be found in here.
• x86_64-pc-windows-msvc is built in github's windows-latest image. Information could be found in here.

Docker

This project provided Docker images for the linux/i386 and linux/amd64 and linux/arm64/v8 architectures.

:warning: Docker containers do not have access to IPv6 by default: Make sure to disable IPv6 Route in the client or enable IPv6 access to docker containers.

Pull from GitHub Container Registry

Docker will pull the image of the appropriate architecture from our GitHub Packages.

docker pull ghcr.io/shadowsocks/sslocal-rust:latest
docker pull ghcr.io/shadowsocks/ssserver-rust:latest

Build on the local machine（Optional）

If you want to build the Docker image yourself, you need to use the BuildX.

docker buildx build -t shadowsocks/ssserver-rust:latest -t shadowsocks/ssserver-rust:v1.15.2 --target ssserver .
docker buildx build -t shadowsocks/sslocal-rust:latest -t shadowsocks/sslocal-rust:v1.15.2 --target sslocal .

Run the container

You need to mount the configuration file into the container and create an external port map for the container to connect to it.

docker run --name sslocal-rust \
  --restart always \
  -p 1080:1080/tcp \
  -v /path/to/config.json:/etc/shadowsocks-rust/config.json \
  -dit ghcr.io/shadowsocks/sslocal-rust:latest

docker run --name ssserver-rust \
  --restart always \
  -p 8388:8388/tcp \
  -p 8388:8388/udp \
  -v /path/to/config.json:/etc/shadowsocks-rust/config.json \
  -dit ghcr.io/shadowsocks/ssserver-rust:latest

Deploy to Kubernetes

This project provided yaml manifests for deploying to Kubernetes.

You can leverage k8s Service to expose traffic outside, like LoadBalancer or NodePort which gains more fine-grained compared with fixed host or port.

For a more interesting use case, you can use a Ingress(Istio, nginx, etc.) which routes the matched traffic to shadowsocks along with the real web service.

Using kubectl

kubectl apply -f https://github.com/shadowsocks/shadowsocks-rust/raw/master/k8s/shadowsocks-rust.yaml

You can change the config via editing the ConfigMap named shadowsocks-rust.

For more fine-grained control, use helm.

Using helm

helm install my-release k8s/chart -f my-values.yaml

Below is the common default values you can change:

# This is the shadowsocks config which will be mount to /etc/shadowocks-rust.
# You can put arbitrary yaml here, and it will be translated to json before mounting.
servers:
- server: "::"
  server_port: 8388
  service_port: 80 # the k8s service port, default to server_port
  password: mypassword
  method: aes-256-gcm
  fast_open: true
  mode: tcp_and_udp
  # plugin: v2ray-plugin
  # plugin_opts: server;tls;host=github.com

# Whether to download v2ray and xray plugin.
downloadPlugins: false

# Name of the ConfigMap with config.json configuration for